The EU AI Act: risk categories, prohibited practices and obligations
The EU AI Act is the first comprehensive legal framework for artificial intelligence, using a risk-based approach. It bans certain practices, imposes strict duties on high-risk systems, and sets transparency and safety rules for general-purpose AI models. The European AI Office and national authorities enforce the regulation.
Risk categories under the AI Act
The European Commission's AI Act page describes four levels of risk: unacceptable, high, transparency, and minimal. Unacceptable risk systems are banned outright. High-risk systems face strict obligations before market entry. Limited risk systems require transparency measures, while minimal risk is unregulated.
The Future of Life Institute's high-level summary notes that most of the regulation focuses on high-risk AI systems, with lighter duties for limited risk and none for minimal risk. The classification determines the extent of compliance required from providers and deployers.
The risk-based approach means that the same technology may be regulated differently depending on its intended use. For example, an AI system used for exam scoring in education is high-risk, while a similar system for personal entertainment is not.
Prohibited practices
Article 5 of the AI Act lists practices that are prohibited because they pose unacceptable risk. According to the AI Act Article 5 page, these include deploying subliminal or manipulative techniques that distort behavior and cause significant harm, exploiting vulnerabilities related to age or disability, and social scoring by public or private entities.
Other banned practices include untargeted scraping of facial images from the internet or CCTV to build recognition databases, emotion recognition in workplaces and schools, and biometric categorisation to infer sensitive attributes such as race or sexual orientation. The European Commission's AI Act page also lists individual criminal offense prediction based solely on profiling and real-time remote biometric identification for law enforcement in public spaces, with narrow exceptions.
The prohibition on generating non-consensual intimate imagery and child sexual abuse material is scheduled to take effect later than the other bans, as noted on the same Commission page. The Commission has published guidelines to help stakeholders interpret the prohibited practices.
Obligations for high-risk AI systems
High-risk AI systems are those that can seriously affect health, safety, or fundamental rights. Annex III of the AI Act lists areas such as biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, and justice. Providers must meet strict requirements before placing such systems on the market.
The European Commission's AI Act page outlines these obligations: adequate risk assessment and mitigation, high-quality datasets to avoid discrimination, activity logging for traceability, detailed documentation, clear information to deployers, human oversight, and robustness, cybersecurity, and accuracy. These duties apply from a specified date for most high-risk uses.
Deployers of high-risk systems also have responsibilities, though fewer than providers. The Future of Life Institute's high-level summary explains that deployers must use the system according to instructions and monitor for risks, among other duties.
General-purpose AI and the code of practice
General-purpose AI models, such as large language models, have specific obligations under the AI Act. The Future of Life Institute's high-level summary states that all GPAI providers must supply technical documentation, comply with copyright law, and publish a summary of training data. Providers of models with systemic risk must also conduct evaluations, mitigate risks, and report serious incidents.
To help industry comply, the European Commission published the General-Purpose AI Code of Practice. This voluntary tool has three chapters: transparency, copyright, and safety and security. Providers who sign it can demonstrate compliance with the AI Act's obligations, reducing administrative burden. The code was endorsed by the Commission and the AI Board.
The safety and security chapter applies only to the most advanced models with systemic risk. Signatories include major AI developers, and the code is complemented by Commission guidelines on key concepts.
Enforcement and the European AI Office
The European AI Office is the central body for enforcing the AI Act, especially for general-purpose AI. It conducts evaluations of GPAI models, requests information and measures from providers, and can apply sanctions. The office also supports member state governance bodies and fosters international cooperation.
The AI Office employs over 125 staff across units covering regulation, safety, innovation, and societal good. It works with the European AI Board, a Scientific Panel, and an Advisory Forum to ensure consistent implementation. The office also oversees the AI Pact, a voluntary initiative for early compliance.
Penalties for non-compliance vary by type and severity. The IBM overview of the EU AI Act notes that fines can range from a percentage of worldwide annual turnover to fixed amounts, depending on the infringement. Each member state must designate market surveillance authorities to enforce the rules.
| Risk level | Examples | Obligations |
|---|---|---|
| Unacceptable | Social scoring, manipulative AI, untargeted facial scraping | Prohibited outright |
| High | CV-sorting, credit scoring, exam evaluation | Risk assessment, data quality, logging, documentation, human oversight |
| Limited | Chatbots, deepfakes | Transparency: inform users they interact with AI |
| Minimal | Spam filters, AI in video games | No specific obligations |
Frequently asked questions
What are the four risk categories in the EU AI Act?
The AI Act defines unacceptable, high, limited, and minimal risk. Unacceptable risk is banned, high risk has strict obligations, limited risk requires transparency, and minimal risk is unregulated.
Which AI practices are prohibited under the AI Act?
Prohibited practices include manipulative techniques causing harm, social scoring, untargeted scraping of facial images, emotion recognition in workplaces and schools, and real-time remote biometric identification for law enforcement, with narrow exceptions.
What obligations apply to high-risk AI systems?
Providers must implement risk assessment, ensure data quality, log activities, provide documentation, enable human oversight, and meet robustness and cybersecurity standards before market placement.
How does the AI Act regulate general-purpose AI models?
GPAI providers must supply technical documentation, comply with copyright law, and publish training data summaries. Models with systemic risk face additional evaluation, mitigation, and incident reporting duties.
Who enforces the EU AI Act?
The European AI Office enforces rules for general-purpose AI, while member states designate market surveillance authorities. The AI Office can evaluate models, request information, and impose sanctions.